hxxps://github[.]com/Mist0090/Monoxide-peaceful/releases

Analysis

user interaction
yes
max time kernel
882s
max time network
890s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/07/2026, 08:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/Mist0090/Monoxide-peaceful/releases
Sample260714-kagpgabx31

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
79	804	msedge.exe

Executes dropped EXE 1 IoCs

pid	Process
4468	Monoxidex86.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Monoxidex86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
804	msedge.exe

Checks processor information in registry 2 TTPs 25 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134284910521151057"	msedge.exe

Modifies registry class 24 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{C7B4E6C8-3446-4BFA-824D-68FEA06165FE}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e8005398e082303024b98265d99428e115f0000	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Downloads"	firefox.exe

Suspicious behavior: AddClipboardFormatListener 5 IoCs

pid	Process
1088	vlc.exe
4624	WINWORD.EXE
4624	WINWORD.EXE
2088	vlc.exe
6936	vlc.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3432	mspaint.exe
3432	mspaint.exe
1768	mspaint.exe
1768	mspaint.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

pid	Process
1088	vlc.exe
4624	WINWORD.EXE
2088	vlc.exe
6936	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeShutdownPrivilege	6392	wmplayer.exe
Token: SeCreatePagefilePrivilege	6392	wmplayer.exe
Token: SeShutdownPrivilege	2076	unregmp2.exe
Token: SeCreatePagefilePrivilege	2076	unregmp2.exe
Token: SeDebugPrivilege	3224	firefox.exe
Token: SeDebugPrivilege	3224	firefox.exe
Token: SeDebugPrivilege	3932	firefox.exe
Token: SeDebugPrivilege	3932	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
1088	vlc.exe
1088	vlc.exe
1088	vlc.exe
1088	vlc.exe
1088	vlc.exe
2088	vlc.exe
2088	vlc.exe
2088	vlc.exe
6936	vlc.exe
6936	vlc.exe
6936	vlc.exe
6392	wmplayer.exe
3224	firefox.exe
3224	firefox.exe
3224	firefox.exe
3224	firefox.exe
3224	firefox.exe
3224	firefox.exe
3224	firefox.exe
3224	firefox.exe
3224	firefox.exe

Suspicious use of SendNotifyMessage 38 IoCs

pid	Process
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
1088	vlc.exe
1088	vlc.exe
2088	vlc.exe
2088	vlc.exe
6936	vlc.exe
6936	vlc.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4468	Monoxidex86.exe
1088	vlc.exe
3432	mspaint.exe
1768	mspaint.exe
3432	mspaint.exe
3432	mspaint.exe
3432	mspaint.exe
1768	mspaint.exe
1768	mspaint.exe
1768	mspaint.exe
4744	OpenWith.exe
4624	WINWORD.EXE
4624	WINWORD.EXE
4624	WINWORD.EXE
4624	WINWORD.EXE
4624	WINWORD.EXE
4624	WINWORD.EXE
4624	WINWORD.EXE
4624	WINWORD.EXE
4624	WINWORD.EXE
4624	WINWORD.EXE
4624	WINWORD.EXE
4624	WINWORD.EXE
2088	vlc.exe
6936	vlc.exe
3224	firefox.exe
3224	firefox.exe
3224	firefox.exe
3224	firefox.exe
3224	firefox.exe
3224	firefox.exe
3224	firefox.exe
3224	firefox.exe
3224	firefox.exe
3224	firefox.exe
3224	firefox.exe
3224	firefox.exe
3224	firefox.exe
3224	firefox.exe
3224	firefox.exe
3224	firefox.exe
3224	firefox.exe
3224	firefox.exe
3224	firefox.exe
3224	firefox.exe
3224	firefox.exe
3224	firefox.exe
3224	firefox.exe
3224	firefox.exe
3224	firefox.exe
3224	firefox.exe
3224	firefox.exe
3224	firefox.exe
3224	firefox.exe
3224	firefox.exe
3224	firefox.exe
3224	firefox.exe
3224	firefox.exe
3224	firefox.exe
3224	firefox.exe
3224	firefox.exe
3224	firefox.exe
3224	firefox.exe
3224	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3980 wrote to memory of 4996	3980	msedge.exe	85
PID 3980 wrote to memory of 804	3980	msedge.exe	86
PID 3980 wrote to memory of 2208	3980	msedge.exe	87
PID 3980 wrote to memory of 2208	3980	msedge.exe	87
PID 3980 wrote to memory of 2208	3980	msedge.exe	87
PID 3980 wrote to memory of 3368	3980	msedge.exe	89
PID 3980 wrote to memory of 3368	3980	msedge.exe	89
PID 3980 wrote to memory of 1452	3980	msedge.exe	90
PID 3980 wrote to memory of 1452	3980	msedge.exe	90
PID 3980 wrote to memory of 1452	3980	msedge.exe	90
PID 3980 wrote to memory of 2676	3980	msedge.exe	91
PID 3980 wrote to memory of 2676	3980	msedge.exe	91
PID 3980 wrote to memory of 2676	3980	msedge.exe	91
PID 3980 wrote to memory of 4556	3980	msedge.exe	92
PID 3980 wrote to memory of 5076	3980	msedge.exe	93
PID 3980 wrote to memory of 4556	3980	msedge.exe	92
PID 3980 wrote to memory of 4556	3980	msedge.exe	92
PID 3980 wrote to memory of 5076	3980	msedge.exe	93
PID 3980 wrote to memory of 5076	3980	msedge.exe	93
PID 3980 wrote to memory of 2344	3980	msedge.exe	98
PID 3980 wrote to memory of 1572	3980	msedge.exe	99
PID 3980 wrote to memory of 2344	3980	msedge.exe	98
PID 3980 wrote to memory of 1572	3980	msedge.exe	99
PID 3980 wrote to memory of 4696	3980	msedge.exe	101
PID 3980 wrote to memory of 3744	3980	msedge.exe	104
PID 3980 wrote to memory of 3744	3980	msedge.exe	104
PID 3980 wrote to memory of 3064	3980	msedge.exe	105
PID 3980 wrote to memory of 3064	3980	msedge.exe	105
PID 3980 wrote to memory of 3064	3980	msedge.exe	105
PID 3980 wrote to memory of 4628	3980	msedge.exe	106
PID 3980 wrote to memory of 2940	3980	msedge.exe	107
PID 3980 wrote to memory of 2940	3980	msedge.exe	107
PID 3980 wrote to memory of 4468	3980	msedge.exe	110
PID 6392 wrote to memory of 6596	6392	wmplayer.exe	133
PID 6596 wrote to memory of 2076	6596	unregmp2.exe	134
PID 6168 wrote to memory of 3224	6168	firefox.exe	140
PID 6168 wrote to memory of 3224	6168	firefox.exe	140
PID 3224 wrote to memory of 5616	3224	firefox.exe	141
PID 3224 wrote to memory of 5616	3224	firefox.exe	141
PID 3224 wrote to memory of 5616	3224	firefox.exe	141
PID 3224 wrote to memory of 2700	3224	firefox.exe	142
PID 3224 wrote to memory of 2700	3224	firefox.exe	142
PID 3224 wrote to memory of 2700	3224	firefox.exe	142
PID 3224 wrote to memory of 2700	3224	firefox.exe	142
PID 3224 wrote to memory of 5476	3224	firefox.exe	143
PID 3224 wrote to memory of 5476	3224	firefox.exe	143
PID 3224 wrote to memory of 5476	3224	firefox.exe	143
PID 3224 wrote to memory of 5476	3224	firefox.exe	143
PID 3224 wrote to memory of 5500	3224	firefox.exe	144
PID 3224 wrote to memory of 5500	3224	firefox.exe	144
PID 3224 wrote to memory of 5500	3224	firefox.exe	144
PID 3224 wrote to memory of 5088	3224	firefox.exe	145
PID 3224 wrote to memory of 5088	3224	firefox.exe	145
PID 3224 wrote to memory of 5088	3224	firefox.exe	145
PID 3224 wrote to memory of 5088	3224	firefox.exe	145
PID 3224 wrote to memory of 5868	3224	firefox.exe	146
PID 3224 wrote to memory of 5868	3224	firefox.exe	146
PID 3224 wrote to memory of 5868	3224	firefox.exe	146
PID 3224 wrote to memory of 5868	3224	firefox.exe	146
PID 3224 wrote to memory of 5360	3224	firefox.exe	147
PID 3224 wrote to memory of 5360	3224	firefox.exe	147
PID 3224 wrote to memory of 5360	3224	firefox.exe	147
PID 3224 wrote to memory of 5360	3224	firefox.exe	147
PID 3224 wrote to memory of 4948	3224	firefox.exe	148

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/Mist0090/Monoxide-peaceful/releases
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x290,0x7ffc3d9ec188,0x7ffc3d9ec194,0x7ffc3d9ec1a0
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1768,i,13387729105688149666,7768049870180539751,524288 --field-trial-handle=2248,i,3377621392012470739,6478558105854483821,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,5583702483564997035,16867499251002643102,262144 --field-trial-handle=2248,i,3377621392012470739,6478558105854483821,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2584,i,8613719662865734830,1614774011255541152,524288 --field-trial-handle=2248,i,3377621392012470739,6478558105854483821,262144 --variations-seed-version --mojo-platform-channel-handle=1384 /prefetch:8
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,3687632762687274298,15971558339697425771,2097152 --field-trial-handle=2248,i,3377621392012470739,6478558105854483821,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,14986647064755601245,11393582841084862669,2097152 --field-trial-handle=2248,i,3377621392012470739,6478558105854483821,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,2508327319849245720,16432662647805981892,2097152 --field-trial-handle=2248,i,3377621392012470739,6478558105854483821,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,13517848170776185722,16672479207037084179,2097152 --field-trial-handle=2248,i,3377621392012470739,6478558105854483821,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:2
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,1291063063815993345,65905832566347650,524288 --field-trial-handle=2248,i,3377621392012470739,6478558105854483821,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,3292436700382449621,11965465945386723871,524288 --field-trial-handle=2248,i,3377621392012470739,6478558105854483821,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,16747066178010456248,4855766223152074398,524288 --field-trial-handle=2248,i,3377621392012470739,6478558105854483821,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,16747066178010456248,4855766223152074398,524288 --field-trial-handle=2248,i,3377621392012470739,6478558105854483821,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,10093729446764354503,2916671745219045531,524288 --field-trial-handle=2248,i,3377621392012470739,6478558105854483821,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:8
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6332,i,15556045854103163130,5069685889981932149,2097152 --field-trial-handle=2248,i,3377621392012470739,6478558105854483821,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:1
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,15887573595428125118,13289296320672154657,524288 --field-trial-handle=2248,i,3377621392012470739,6478558105854483821,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:8
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6824,i,10712031174293017875,13196804767748433622,524288 --field-trial-handle=2248,i,3377621392012470739,6478558105854483821,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:8
  2⤵
  PID:2940
- C:\Users\Admin\Downloads\Monoxidex86.exe
  "C:\Users\Admin\Downloads\Monoxidex86.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4468

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3968

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x150 0x4c4
1⤵
PID:4968

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1088

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\EnableTrace.wmf"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3432

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\EnableTrace.wmf"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:1896

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4744

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\WriteUnprotect.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4624

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2088

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:6936

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:6392
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6596
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:2076

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:7152

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:6168
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3224
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2020 -prefsLen 27099 -prefMapHandle 2024 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {b6572e49-2ed5-436e-a2df-313b78d55eb2} -parentPid 3224 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3224" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:5616
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2472 -prefsLen 27135 -prefMapHandle 2476 -prefMapSize 270279 -ipcHandle 2424 -initialChannelId {36b09f77-ed4f-4271-a1f2-51f4a8f973b1} -parentPid 3224 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3224" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:2700
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3672 -prefsLen 27276 -prefMapHandle 3676 -prefMapSize 270279 -jsInitHandle 3680 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3684 -initialChannelId {63657bed-cf22-4a18-a761-838be898dd8d} -parentPid 3224 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3224" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:5476
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3864 -prefsLen 27276 -prefMapHandle 3868 -prefMapSize 270279 -ipcHandle 3988 -initialChannelId {a84c2f50-7368-434b-b574-229d5ef9d154} -parentPid 3224 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3224" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:5500
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4376 -prefsLen 34775 -prefMapHandle 4380 -prefMapSize 270279 -jsInitHandle 4384 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4392 -initialChannelId {f2c8d268-9a53-46b8-a764-1b13f3bc12c1} -parentPid 3224 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3224" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:5088
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4980 -prefsLen 35012 -prefMapHandle 4976 -prefMapSize 270279 -ipcHandle 4960 -initialChannelId {4d2326c1-349f-4bab-a51e-52b5219cc0c4} -parentPid 3224 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3224" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5868
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5124 -prefsLen 32900 -prefMapHandle 5128 -prefMapSize 270279 -jsInitHandle 5132 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5140 -initialChannelId {ac1b299b-c8d5-4b0d-abdc-19267303d942} -parentPid 3224 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3224" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5360
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5272 -prefsLen 32900 -prefMapHandle 5276 -prefMapSize 270279 -jsInitHandle 5280 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5288 -initialChannelId {0f5eb1af-8516-41d4-8af8-3f4d49cc04d1} -parentPid 3224 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3224" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:4948
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5632 -prefsLen 32952 -prefMapHandle 5636 -prefMapSize 270279 -jsInitHandle 5640 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5648 -initialChannelId {e9da5007-0bb7-459f-8cfa-56398c0e57c0} -parentPid 3224 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3224" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5820
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 4 -prefsHandle 5172 -prefsLen 39837 -prefMapHandle 3120 -prefMapSize 270279 -ipcHandle 3164 -initialChannelId {646a1231-2673-42f3-a0bf-38061c657296} -parentPid 3224 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3224" -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 utility
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:3932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9420686d12b2cba6dc69896d607eadac629280a010e5358a4872ab9753f24ed7
MD5 8be6e81804d8b903ae07c11b2e53e3d9
SHA1 817c41cb00b05a8f2040323b93c6416b92dbc01b
SHA512 c2cfff48ebb312975aa2615d841d0badff185589ad3a3f5e8420c2ea0eb5dc0e5354d917cc43d57bec169a63d4fa21d66e91dc3e195592ece23d37fff7c04680
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
TLSH
T1CDB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 27d61c282e4bf112aed3bd07eaaab8788d75224f5e199bab857064cbd5d982a1
MD5 46e65d035adc969e8d04500bca4c5db3
SHA1 fc81b055409d470ed84cfc8497034037eb5a1ee4
SHA512 26b4bf0615d85574c1a8017270ee3e215341811d6c55c46a00d6a9c6c2e6ebbca4202d7b57c225f8b253c27394d706b1e2825b17c78aa7a2e17599e82aceedfe
TLSH
T13FD0231076397AD3D23A147E54718B01B91581777377F3417151440D9D750C6F68B6D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
MD5 504ce80b644a85a7e68d85bd24169289
SHA1 1f740a722dfa97fc8fb30626b0e3d6217e4a9864
SHA512 9406464a4f6becd85591c12af8a97fdecfa2208649138f347fb50d3e28f1583adec061050924fa0405e46eb75af7e299e6564c2ed039db9d82c50326da32a3c5
TLSH
T19ED08023371D7582F75B41759053D7025A1680756463F701B325D41C9A750C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 1f43b380786200e87778706fd9258612cd3ce14a06b2c410a4eed3ae3340dba1
MD5 2e55b1d2dc6c3a7d6bd5577a2e768a61
SHA1 e7d801a3d6bcc93b8947bf59b3fdbf67818539e8
SHA512 749c3dedc51bdccec6047e98ad12471630e14279c51b733a34e681c0cd4018caf31ef9d8093df4998f82b09eaaac3a11d52da8bd48a644416ae2f43c25984183
SSDEEP 96:uDovrilKaGxYbV34cElOSKqdzx2OCtY3ekoaPn:hri2CgOSTuUPn
TLSH
T1C6B14E3612B788E2E33D0039FFE9895DBABBA0F5F9972EE113806C36D114F935502448
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe581fd7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe581fd7.TMP
Size 3KB
SHA256 ab7edf950b065a6bc7777d9cf2742e35d6f23c9f3bac401a304e7b3b2790b3fa
MD5 b6e9e37c993c2cf46871b435de8a9428
SHA1 f4346a981cb96abeb755d54153e4685c35cbe1dc
SHA512 a7adb8a539f33caf20b5c7b2a62b996c3c64904bd617b52a59f171c9e59eeca9e3d42f1aab0b9fce6bde5efce922cb29bc286ea9c405262b67c76e1624a23f87
TLSH
T1097180351286C8E1F3710032BCE9426EBB73B5C9F9A7AEE151D0BC372508F92960714C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 52a9beed31e4b53a9ac536e0355a7f1b5f6586dcac90d423629f94eff31c3da3
MD5 acb0641135fa9d26e394a1cb2fcd0073
SHA1 42a940cf7358e25d93b10d8db8d39442ffe45c5e
SHA512 c00515e0c304e812623edb98d7a3a38a4e1ae5f167c176b4a9d5ef0aece5a131dd040e51b4c9e2f31ea069b66ae627881d680018e1af0d3e7acd0038bd99ee15
TLSH
T103415CF787E1956D9A125AF0AA18EE2BCE2C0511831C7C6985E0BE57E3F3871E10275F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 51e0b3ac5354f12f5e6cd402bd6ec41b223b1dd06d9efe136b824cd392b5b380
MD5 d029e447010c7f9ea8166915e5e51b92
SHA1 d125664a0518ac9b00a0a075396b341638568b32
SHA512 5e58318d0123771081a216a9a9085f8fb40319f4ff8273cdf0aaa0e69507a78ae6fd13d3a02a55e2368de5c170d18b6745148a341f15990e581f05f420409a3d
SSDEEP 192:sxZ1MRCyM/jK1Ml8C9s/f7sKWpVGt/BIdp9mGHW6+WNWlC5n0/YABvUkrLIgqJ:sxZ1Mcps/f7sKWvGtCvHbWkG/r/m
TLSH
T1FB62D7126A34597BCCD7D21DFA557B93D6F90422E6901E48AAFC9A1C01F6BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 4698f53c31d9ffc1e5ddf01aa8ca2e994aecbec4ad110ed6a5ec729f9498d49e
MD5 f24bdf8b0aee1955d05daca520bde122
SHA1 387a4928f2bf3846627a073db030ca62ad413f3b
SHA512 413cf4898223bbb8ed19cfb3a6231e13f7f6a3a0eb2dcb03c4e84cebeb8efaad9d31a6c58070aa26d42fea5f74fbd04e89328e101b8ee66cc8598dbf6b89b2d6
SSDEEP 768:RZsqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9yroC88:RZsqxXlWvJD6Tu1ja54LAs9pC5
TLSH
T121D21B3B694CCB7E4F840E5CEC266FD76ED801CB66988D5447FA880C03CB2EA11165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 169c4a0754dd29557b600fcc52b0f53427495e814d52d7eb8ca4db5636642530
MD5 caa733e842d555c7ce3a1dad53e21231
SHA1 b5ae0fc43c8c1abe24c9477d1eab1ef718a3cbc2
SHA512 265f475ed20e0bba2a44bd857499c0bf4bbca11817cafbae673e021246b95b43813c45b0ddc3033e32d7962b1035e8784342b8225c22b62048a24fa9d15e0762
SSDEEP 96:KYbaKYIK6G0K/ai2t6KWElUgKxmSONaK2A+:ExH3ZFDNj
TLSH
T10DE1381B313A0662387E2988B296CA3B4F4231637118A57F7FB950B55E6EE110DFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 38eda39c12c97f00aaf1868371b20120ee254a698064c66c68b70baa085ad5a3
MD5 e1bab9a512459d8b95e3deb0ae653bc6
SHA1 548a3062c3b69af348b5645815ce42ef61c2e4c8
SHA512 e7f0b0f314dad4f5cf2eaeff148ad9518a5f92a34b0d41b0a88e59fdf1a80518eae1a22bc3647c05cea4be0d5b4b46398925a0aabe439f21e9708929f8fc038c
SSDEEP 384:/tNn/s3n9SQsNdfCbmPbBoTVRN5Oj9z9d+2fusrvvKASBXd1sxi5mkc1chOObjI8:/j+9HV6exH5Oj9z9dlmsrtSWk5US29MF
TLSH
T1F2C27B72D8644DE74491E4C96187F4176EB84137C28D1A8CE2F8BB3C32AF8FC5362829
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a91c4dcee09fe12197eb69586760d59e16b501311748212de67acd48d4461869
MD5 f745b7c3e038cd74f81dc0189ecef84a
SHA1 41224752921f3046761691899b09b32074dcfaff
SHA512 86c4b68a0abbb5a3085227b2663b2e4f20b12c8aa877f87d5a0b5bd406e421f514b711a38b7a8c8f3dc7f8b8518f06935361a78858674be731d52a514f5e38ce
SSDEEP 192:tONiD6JkRtQmiUy3NW+RN5Om5o92h3DRXU6:tONiD6UraW+RN5Oj9+RU6
TLSH
T1A302D9356D385C779EF2AE09B98737175FA4207BE9852F84DAE81B0C01E769C2347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 cee9ffe4237029a61e2e90a9e3df494c5ca10a5c2b9d29d4baeb8727520a73f3
MD5 8ea6d88160e63b16c3a816f014a1c28b
SHA1 4d4d325ae69568329c49db6028b35f8b0a7c0171
SHA512 608e679479beb70450619003ca4820780922f0ac89538a66eb7711595bcd00ca962b651035569ec18d365f89d436d16839ac097ad606eb003a74a19cb76b3382
SSDEEP 192:6ONF+6JkROQmiUyniNB+RN5Om5o9nz9d+2fulVcxqhoU6:6ONo6UKjB+RN5Oj9z9d+2fuI/U6
TLSH
T10B121936AD385C775EE2A941F48731534FA95167EA896F80D1DC2F0C02FF9AC234B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 896KB
SHA256 3ee720caf3f6c61dd86b71f197b5bd19a5667410a2797317f88f1f29ac6eb104
MD5 93ca60d658fc7af3b5edf735eb31582e
SHA1 6965d8093dfac04ccc1388c2773b865e92293d31
SHA512 5cf8b6fad7e443e44b07255c967792a59cbbf65a1c11b771ca789f2f8ab368f91cc6c2bc4cfac92d8dd41a8c758fe049933d81394e74402f329e4e72054df131
SSDEEP 768:20aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbaL:YZP/tMiPuNnY4UmqEMioTaBacg
TLSH
T100153137D150B085CF2C71B2E5AD5F0CBE23A10712E142465FB8A67BBA633C99D1B1E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 1024KB
SHA256 41cec9c0f17707f89885f6c7bcbd18aa4a2e4994112523ef278a0e1f5c4ee600
MD5 3abb3ab25ba8ff8a75a83f16e713d87d
SHA1 1879dbd0e71d808f5fbc1007c56b0cca63d58779
SHA512 a538ad69b497b02d11cec648fb2cc9cb3748ba40f6e4acd0ba1b7fc2a781442bcae0ca641e9357dbc45b8fd2ed31f12a658c7b83ccdb52a07129c68e89be5632
SSDEEP 768:D0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbad:9ZP2tFP3vqY8IqEMVTaBacg
TLSH
T116258437D190B0C5CE2C7071E9ED8F09BA23A10B12A052465FF8957E7A633D99D1B1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 95767b2224309ff5e9a84616312479bf5e1ca913245ce48e5e07372ec89aeb7d
MD5 06a99eb5de72882e6cfe5996096d5a61
SHA1 cbec3922e868cf840584f0473e8fc8e0f64b112f
SHA512 0fdf59db41b31e22a980f5a713d6d20b5190f566e390d3d6a387f142fb3d15246aa2753129154a146cf664656d834515003201133d08af70fb3374a17532bd04
TLSH
T104412758A6F94108B3766F56ABF7A46E487FB9772F06C49E01100E4F0A63A40D8A1B37
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 abd25268f6049585b0801084c5f5b9029fc227cbff90da2df31e5c6f477e700e
MD5 f1908a008f254850e2598d3126d315f5
SHA1 622ff475ab8a1add483d149a922c4fb04b2fa04a
SHA512 7b76320ae6d29a523cf608d7f354fbba1ed0da5ccd319525472ef7804afcf9f4dcb478fb690a34a263a1221b47e858a8a80dc7e5b514f92a86b8166c78d2d9b4
TLSH
T1DC514C6C6AFD1159B3776F569BF6B86E847EB9763F06805E00110D4F0A23B40C9A1B37
MD5 SHA1 SHA512 TLSH

Submit Download

WMSDKNS.XML.bak

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9512A4488B00CC053350DAC32D417B4A35C11513

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pltyyssw.default-release\cache2\entries\9512A4488B00CC053350DAC32D417B4A35C11513
Size 15KB
SHA256 cd02b8b6cc248213ed1673e93a7a984a45ef83fa994c8c382841565cfd41b594
MD5 8e62e998c2c7872517316161369845a1
SHA1 98a9a23a768f1ad2e211a75acdf3a7e1da96f7f5
SHA512 afce412a78d85ca9ea35ac15e5b71f626cc0ef87859c05468004d8aba306ea6755182cb8c950daa28badd908fe5fc71def6d090f5ccea159094273db58f7a8a3
SSDEEP 384:H9XghOiO024YvNdcs3hk2nhfdDE2Ba/rIVy8ep141O:dX+ZYvNdv3hk2nhfS2sDIVy86a4
TLSH
T13D729DBB9F416C5D1957E585C8AD8369DC05FDABCBF690A608243489CB8432AB0F60CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pltyyssw.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 9815bbe84e99eed564eb77c982d0bd67436b8c3762c1dcf145726f49ff8b3603
MD5 a4d846fc7a49110df9b39e9350a7c181
SHA1 c58ca672ff4f547f719963196e366a6db0691e17
SHA512 dae018958d7ec199d3d5927f836479cd32bfdf8da33b9bddf764029e73bdbd554d5b5a87c19ac61ae51033bb85eafeb0806a704e1dff37d738b06202afd5018c
SSDEEP 1536:jTrlitPEDih3nsJz0rgvcyd/2TkhkGbwPUQnyJ8W5piJgpF0Uj2bNGBv17uLyyZ5:j3lYsJz9/Akhyx0iM082i17qQu+NorT
TLSH
T133B3AFF6DBA3897D68FFD4295AC2883EFD262840B3E73009C963771061C6F686675709
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iso690.xsl

Path C:\Users\Admin\AppData\Local\Temp\TCD7534.tmp\iso690.xsl
Size 263KB
SHA256 3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
MD5 ff0e07eff1333cdf9fc2523d323dd654
SHA1 77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
SHA512 b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
SSDEEP 6144:JwprAiaR95vtfb8pDbgWPzDCvCmvQursq7vImej/yQ4SS1apSiQhHDOruvoVeMUX:We
TLSH
T1094469A5E6D9CF144BB1F23FD8A53092EA1DC87B29341D41F1DC733717AE948822B662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 c4279e5b84f5bf75f0aae762dcc175f6c6d7565d4917cab4d76f8a63052fa933
MD5 6682760433428d2e2cd307246febb279
SHA1 54e540a52a46728cfc2a789b8185045f15aa5ba5
SHA512 fec2900ed5d3c198cbf15d514a5034384712bcefbc2f91d7150b59cab4b955363eb2e7ef47a2a6f8c9d635c8cc79a3e3d7dd1c081a8cc24d680b3cc9ff1fadcd
TLSH
T1A421495B1B8DD87089E01BE75DEC8E2573B787CE93A0D0A5B38CA039480256D6B3D06D
MD5 SHA1 SHA512 TLSH

Submit Download

APASixthEditionOfficeOnline.xsl

Path C:\Users\Admin\AppData\Roaming\Microsoft\Bibliography\Style\APASixthEditionOfficeOnline.xsl
Size 325KB
SHA256 9095fe60c9f5a135dfc22b23082574fbf2f223bd3551e75456f57787abc5797b
MD5 58aafddc9c9fc6a422c6b29e8c4fcca3
SHA1 1a83a0297fe83d91950b71114f06ce42f4978316
SHA512 1ebb116bae9fe02ca942366c8e55d479743abb549965f4f4302e27a21b28cdf8b75c8730508f045ba4954a5aa0b7eb593ee88226de3c94bf4e821dbe4513118a
SSDEEP 6144:ybW83ob181+MKHZR5D7H3hgtfL/8mIDbEhPv9FHSVsioWUyGYmwxAw+GIfnUNv5J:Z
TLSH
T1576411A591D2DF054BB2F22ED9952051EF14C0776A382C82F1CC77371BFEA58866B632
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
Size 260B
SHA256 427133a978a8f998ce738f530d0eeefd526a3785784cef27a1cc53fcc054bb69
MD5 10b43bc54ca4bb5e9ffa2761a331e805
SHA1 9527412c56cbcf1f40448d6df7f3f796b08a2da5
SHA512 9a113774a36d9487afa16b9780f4ed2790d8866034d5ae7ee500c918099f52de51d3d1b15ac978bd8f62d78b4641269cd8fc27ba9c0da2f2070adb9832153bd2
TLSH
T1C5D05EA3A322EFE653BC80A5397CEEE053F2482DCAAA245024EC5D8E2D1044F2847048
MD5 SHA1 SHA512 TLSH

Submit Download

ExcludeDictionaryEN0409.lex

Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

fb3b0dbfee58fac8.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Size 1KB
SHA256 3891e6d3f079ecafbc37b5f85ee6886ffa77957fd6aaa37ef9ed0efa834e0ce4
MD5 61c84e2b8a9b13c74b0c69c62a41ec92
SHA1 e4f0be94f5f65cff40cc647f026d26ac2ff8d3f4
SHA512 eee7ae4cc70ead1821c9e3bcb71beefe8e1f84296d69d8a598ecc5775ebe505da344c8e6c6612933a29ffa6c5281aed909d7b66f4657f0646259e8fc47e57ade
TLSH
T11B21EE0282CB6F7BE045833710BAA746DB703D33FB8D531D1645A26EA8B0D009EA931B
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 ea2a49144dcc7d56f8caa58347ea30a21019f121c52113de01f63feb69a2f859
MD5 181ee62d3e70188833f5ef145a24b7cb
SHA1 4b6f7b76ed64aa2c20c2449487670e8cd8e6cc55
SHA512 40647bd40624a3a08fcc840726b52732dfaaaecbba7e5575674e9f173cf5148dd34a7cad4e2fd806a5c3083cc89f42cadda432633e215191bde284d02f66f208
SSDEEP 192:jOv5zbowZVtyjiy01d66JozGzgCl6mc0d:sbowZVtyjwd66JozGzgC1j
TLSH
T12AE10C68EB28863BC004037BCDA21F404F39399B984E7F2536ED65082D576DE768E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\events\events
Size 1KB
SHA256 ec1853be1e70fa558ac949e6e3c59c5cc27ff34f0233178f8e663f0700142b21
MD5 366b23bfefa6a2220c6078d005f73f52
SHA1 68609889023ab4adab05027a20fe87cb80827410
SHA512 3d6e92d6d48a7dc8077b2516b53297df636d91c138b6ca8b5934b064fa5e363b362fee25c65f7371fff413497e3915c6d99d0444524f7b434c9a39e980ea0010
TLSH
T11121796D39B84D2AADC7F29C7881128E57614A4714871D470E12FE8DCE91ED9327F439
MD5 SHA1 SHA512 TLSH

Submit Download

07951321-7aa5-48d7-9b1d-f09a93b2c8fb

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\07951321-7aa5-48d7-9b1d-f09a93b2c8fb
Size 883B
SHA256 94cf5078b01d2a8d4dd34c91b64c2ae11a33756714672d69cdda793067f4f1dc
MD5 65152b718056ad991dfdfafb253d0cad
SHA1 f44f16ef9e11eb713a587a4160263b5204521ca0
SHA512 52469d7f830a6acd9fd20ffa86696cd2440e7d48b2144986714eb583693af7055ee9592c84713bb306b9317da13910a3b801bc6120c5bbd9ec20e21f0fd751d6
TLSH
T10511C0519734B9B2CD68C24FCA613B019FF4B623C4C994143EA95A184D7A91EA3AA20B
MD5 SHA1 SHA512 TLSH

Submit Download

32cb5865-6c03-4640-89a2-fceabbefbbbb

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\32cb5865-6c03-4640-89a2-fceabbefbbbb
Size 886B
SHA256 c860e44261c1880b8cb3d44aa120f169638646f47ddd2c10598156bdd54f6fcc
MD5 81462238a41ec67a74640f0158730ce5
SHA1 63ef43de48de65b88b6c7c346372ad128b1523f1
SHA512 a4e377399000a1e5de1242071a7de6849662b39821af9b0c6857aab391a9e9731a33c6d01430da26a55d5f46cf3f42dd811b1310094f2f13f47ac733fd215e46
TLSH
T19D1104404779B9B1C854D28BDDA07B414FE4B513C0C65C143F944B180DBA81FA36B707
MD5 SHA1 SHA512 TLSH

Submit Download

46347c52-dd27-4285-ba99-f8cc43fe8056

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\46347c52-dd27-4285-ba99-f8cc43fe8056
Size 235B
SHA256 3e3f4365d5dbc8081dc94976a2f95f046d0daba5d3639b047745a0be3bafd45b
MD5 487f3b8a0b69a8c899c8b5206c686e62
SHA1 1bc767801f539dbacdf5b3c5c218c45a0f5e1089
SHA512 34a4d7f80219f4c74eccac57d4384672f9c0aeb0d473c555b86bfe8f4a76284bab2e7f19847ab3555523632459169ff3be064b85e1718188ff5c6329b537453b
TLSH
T164D0978014C8632C08240F1AF1A0A8D732CC8C3318B4A860AA56883CA9F9AC8025181B
MD5 SHA1 SHA512 TLSH

Submit Download

5ead0746-5bc8-459b-9c1e-518a3b2ab5f7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\5ead0746-5bc8-459b-9c1e-518a3b2ab5f7
Size 235B
SHA256 f13d7c8a92870730535276dffaed8503406bc11ceb6a34982d9e92bf6e0b4eb1
MD5 3385d96fb238c3bf667c9fcedf719032
SHA1 5ce4594defd31165f5b51460dc119a0c1412c35a
SHA512 94135c57c7dcf9d3da51f3e9fca77d63eecffdd318b4fa4474c1e0b4a3b90a2a63a4f75d3f9438dc03d033e3bc77ea27200692136364db0fb7830c8611124cf1
TLSH
T11BD097C0249823AD08204F4AB0F069DA30888C3314B46810C6A142B8AAFDEC4425281B
MD5 SHA1 SHA512 TLSH

Submit Download

89c1cd21-5a78-467b-a654-50709cabcc2c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\89c1cd21-5a78-467b-a654-50709cabcc2c
Size 15KB
SHA256 a4df461cc40dcb6e7f4a8d6121ba14627f6751e55c68fd510055e677032992b5
MD5 4061b7c9b7b790d02944fc6929c56b74
SHA1 1c1952f7c855e0bddec3d309453da51f20913094
SHA512 923f6dae3f4c369a600de88f8fc6792213dbab53b9de3baecd23d6f8bd6a942522923127f13f51376a8ef0f4207e0e5ada5f4384a422d575e26bfe3e96dccd99
SSDEEP 192:4otoarmWJZbo7Usr9czaPQSbcvYMEMq8ZuUVu90Sc4wcIUZ/ZB+169xuwyzoIGo1:40oarm0bo77r9c+PQSMsQwiv31
TLSH
T1CF72C816686056BA8251E369D8F87FC3E6F528CF4C019FCACBE4BD085DDE06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd967aff-8719-4852-85a9-615ae73fa6fb

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\dd967aff-8719-4852-85a9-615ae73fa6fb
Size 2KB
SHA256 1395682adb9dc0999458eb7015707755b3ce5e1b989978b210ebfbb600db9981
MD5 9a9c3bcd9182e7bea59ecddd88295bd5
SHA1 2f904404c90af1a1661b15fb0432b6203ba01dd4
SHA512 eedf68cfb1fae7d7896a4cf9a45cd2fc8bb48dce275e50b575f4fd6509bdfd7787acf95d76212926e7ee6127797cbd5a949714cf485139393795e251bd92d104
TLSH
T1B641465C35788D778CDAE55DD982334D57608A1300C628432EA2DE0CCC9965A377E52B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\extensions.json
Size 16KB
SHA256 0d6a34603fd9236716e47c952cb09685f4f4608a0a9f3ed70e36b9ce29ac886f
MD5 bc453676adeb07f8d820e91dbcb71ac8
SHA1 00896d3480e579a26676ea3ff70af1f5d423fe83
SHA512 bd24fd92ff5b0e8a62c4b5c56aeb56ead995d94fd0197a0eb1548349e5b912afbfb1274f2828ee1fe873a6703d17a23a5440980028e9507474a709ac6e48ced8
SSDEEP 384:xzkI4vlUmldvc8dhWt94zT96osL4HdL4PHL4HxL4HEL4HfCs4hr:mI4dRfFXQ4d614d4D4J4+4/r4R
TLSH
T10172521545049EB8294FA79AAA367E02C37D433B60845C38F4DD8FC842FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\prefs-1.js
Size 8KB
SHA256 47d3b2fc4c5c30634d164165443cd26d722d6c0955f27d78144e881a8968c52f
MD5 fa3b110799d9df32bdb20c501cfb6782
SHA1 d97ec1f1bfb023345da80acd5190b44a1f3e7cc8
SHA512 f61f55f686f09e01439fb7b835d74f1c0e05810d2783aad94077262c92f0694d43aaccf1778b43cd9dd16568bc1e4c60fbc047243ae143a46602b69f18244523
SSDEEP 96:xH4f5TUOPqGqsWfKgSObzSsSSladv9jMnIWRo/KbBw88FoO8L4cnTDEMGS:mf4RsWfKgS6SSPRoSbBw88iv
TLSH
T14202007D9104CF7F64B637ACAC2888315AA2023B76BFA8D710B95485051CF3451FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\prefs-1.js
Size 7KB
SHA256 424a0a30fb2c8add28cc8f91239db93d19b94e467bb289d0fd33540c25bf0484
MD5 52f4762890b296e519b11d7348085290
SHA1 d3550d2585b6ce51612173b2511421d56083437f
SHA512 d1a5c428bbdfaca2fd06106592619eb36ef8aad93c0ab1daca212d3ebc23db84e11d518dbce6d34e0bd5aaaf45ae6fdddb94b7e38b6699d56b6434ddafe4f119
SSDEEP 96:xH4fUTUOPqGqsWf2gSObzSsSSladv9jMnIHeABw88n8L4cnTDEMGS:mf5RsWf2gS6SS6eABw88qv
TLSH
T184E11F7895188F6F74B677ACAC6888316AB2413B7BBF68D710B954C4011CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\prefs-1.js
Size 6KB
SHA256 5052f72944d4ffa5b635f96796d076eb1e96bf199e8abe03a7c62e998c29bcd3
MD5 f30cb62e2dc98c2360786f1b12bae357
SHA1 81b3cb39fbcf1c15b124f4aeadb8253d89e3efd2
SHA512 b9c4d5c5aaded0e08139150e96fa31447f5594d378364d9e0d2aa0f876db465ecfd27029af8d01b7685d198b1deacaa8108433aae199f528a799d0cb0649653d
SSDEEP 96:xH4fUTUOPqGqsWf2gS1zSsSSladv9jMnIHeABw88n8L4cnTDEx:mf5RsWf2gS9SS6eABw88qY
TLSH
T146E11E789518CF6F74B677ACAC6888316AB2413B7BBF68D710B95484011CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\prefs.js
Size 6KB
SHA256 1e739ca34c2c6298f6f38e94af259b2f6ec38e619827f80f3c0d922fddcd1854
MD5 06923679a8e6947e33c51b15e733bbfa
SHA1 2313b1a83723174ba0207378ecb0816ffc6bb497
SHA512 8b26a98b2a44c3e76c364223463dea12d5658c9fac81d958afa5ddeb354e86917ae4e33440955dc5673bc0b1a869a48070bee97e59ecf6c9cd145b34f5229c65
SSDEEP 96:xH4fUTUOPqGqsWf24P1zSh6uSSladv9junIHeABw88n8L4cnTDEx:mf5RsWf24P4PSSIeABw88qY
TLSH
T139E12F7895188F6F74B677ACAC6888716AB2413B7BBF68D710B954C4010CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 0da614c332f1e76500868acb1d4721b1b338a5b5dc84a43702a621fc53214e4c
MD5 ce8c188415f58f5979579af4fe05f2f7
SHA1 d11790ea145241993c9a32194ddc6fce3a9d5756
SHA512 a987db1f157a07b6adcd5d1fb4ac2b875a1f0ef6e3e901addab5d5845f0a9b51e9e407d28e8c73297629e0d76f514272a3f06288676ebcd61e4ff49f1abb634c
TLSH
T13721EA857F5B297A2B47814AC4C90FD5D7A9B014C628F8F0E999A90112C8B4A33AE20A
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 c547763c59c5a6710994bf3af8a26a7e19575f3e6406c64c9ba56d063f0c9c12
MD5 b304cab541191a4932b59a541822e2cd
SHA1 cdd1268a03f900fa865ae46a40dc7c2432d63ecf
SHA512 bbb220a79106cd22d3ba9b2f9fce3462201de68870d81786b1c03e30d600ce3210619b479677679898456671e8f5ea855d1b74ee6f4b81e54a430ba18921ecbb
TLSH
T12C210A43A5B71EFDBD62A011C4884FE3C29C34318865F8F041ED9E0612EEA0D774E118
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.1MB
SHA256 b0f6dc805c999462a3b5008e271a05f4a5ddff7d265f0960d6508e9ec626a8c2
MD5 f5c953c92a4ae958eeff1ff4880d14de
SHA1 d4e3689516c2fda05c17e611306837465d857857
SHA512 e499974993388e1fa8f5bd3444eba70318002b8192e9d70e98770f3cb38e1fe970bf0c708b01cdd4abb5e9b0f3adb9566bcaa1828a221083d4a93af604561717
SSDEEP 49152:WDmgkuOjA5lUT2loecNeaKvgmRBbFOYLg/:ympuO856T2KzeaKvgmk/
TLSH
T12E1639F824D1A257F3818037668563EF21AFD00C6467DD484BE966F990B8CDF9E05B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 6.5MB
SHA256 113c4671173d4926fae5e39d9311c460121ce4d1352bea1fdb33d13e3c92c622
MD5 830a8102d80815241ae1a0da9950d86a
SHA1 20357f4df125b5feff3691bf40908846289cb147
SHA512 afea8696567feacd6db99fdc4bc4d2882d925d6d2e796534e660e6d2d678306239d19b37cbd8d9c1ee62e1315ffb7e8b6a2853e388208f1d07c268193516c41d
SSDEEP 49152:nlpwYOVU6VcQzINNAJsJZkYPXZWmoTFke+rdX/L9/bqIMBIa9mt77NabY4d4CCUW:lpw3U6VcQzIVymohZ
TLSH
T19E665CE420E29252F38140B3719953EB21EFC01C6077CE445B9896FAA5B4CEB4E977BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 6.5MB
SHA256 b199217a8a618ec078bf27e304c7ad16bbe122b65ac6b9f86824c90feea68075
MD5 40148ed8b7cebe8e82175a80f4cdbf4c
SHA1 d4491fa8951ae6f5f8bf6e116736d72eb8bc8ce3
SHA512 0bbbf85e6e56f0df9e7ec82b0c16bae24869d75b384c63660e3d226b4798259f0d0a3b147c5c98f5eec7f770507a92478f12cb69f7ae53d2de40f5b96d4a16ab
SSDEEP 49152:GL9Ly5aeUT6QC5zYYHePJ5HbRmWFQd7RN6iafS316KMWYObUtVTTATWnNAJsGfDF:MDWdUtVTTATrWFhhZ
TLSH
T179665CE420E29252F38140B3719953EB21EFC01C6077CE445B9896FAA5B4CEB4E977BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Monoxidex86.exe.crdownload

Path C:\Users\Admin\Downloads\Monoxidex86.exe.crdownload
Size 277KB
SHA256 d02538788fb57f568ece292f5fc20e9775c86d504de67f57e22534f84adc73c6
MD5 dac0c5b2380cbdd93b46763427c9f8df
SHA1 038089e1a0ac8375be797fc3ce7ae719abc72834
SHA512 05cc1f6bf25a6545a06c735ae7a4a7fc25489bdb9fbc8d5797be623982662c4a93cba2d20bfe14313ef1548eaaa691e55fabdd8e3d3e45de9ab42dc62f9a7023
SSDEEP 6144:8nXw1aOBixLVTCB+3ZXF9lOi9E3AAqgmR:8XOixEB+3n9lOi9E3AAqzR
TLSH
T1945471417481DA69CC640170CC6EDAF53E16BEE4CAA249E73AF67F3F3DB014264A6631
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1088-435-0x00007FFC311A0000-0x00007FFC311D4000-memory.dmp

Download

memory/1088-437-0x00007FFC3D400000-0x00007FFC3D411000-memory.dmp

Download

memory/1088-438-0x00007FFC312B0000-0x00007FFC312C9000-memory.dmp

Download

memory/1088-441-0x00007FFC30A80000-0x00007FFC30E10000-memory.dmp

Download

memory/1088-442-0x00007FFC30A60000-0x00007FFC30A74000-memory.dmp

Download

memory/1088-443-0x00007FFC30A40000-0x00007FFC30A51000-memory.dmp

Download

memory/1088-445-0x00007FFC306C0000-0x00007FFC30956000-memory.dmp

Download

memory/1088-446-0x00007FFC305D0000-0x00007FFC306B8000-memory.dmp

Download

memory/1088-448-0x00007FFC30490000-0x00007FFC304D1000-memory.dmp

Download

memory/1088-449-0x00007FFC30460000-0x00007FFC3048F000-memory.dmp

Download

memory/1088-450-0x00007FFC30440000-0x00007FFC30458000-memory.dmp

Download

memory/1088-451-0x00007FFC30410000-0x00007FFC30436000-memory.dmp

Download

memory/1088-452-0x00007FFC303E0000-0x00007FFC3040D000-memory.dmp

Download

memory/1088-453-0x00007FFC303C0000-0x00007FFC303DA000-memory.dmp

Download

memory/1088-454-0x00007FFC303A0000-0x00007FFC303B1000-memory.dmp

Download

memory/1088-455-0x00007FFC30380000-0x00007FFC30391000-memory.dmp

Download

memory/1088-457-0x00007FFC300D0000-0x00007FFC30168000-memory.dmp

Download

memory/1088-458-0x00007FFC30080000-0x00007FFC300CF000-memory.dmp

Download

memory/1088-459-0x00007FFC30050000-0x00007FFC30075000-memory.dmp

Download

memory/1088-460-0x00007FFC2FFA0000-0x00007FFC3004B000-memory.dmp

Download

memory/1088-461-0x00007FFC2FF80000-0x00007FFC2FF9B000-memory.dmp

Download

memory/1088-462-0x00007FFC2FF60000-0x00007FFC2FF72000-memory.dmp

Download

memory/1088-463-0x000001FC41700000-0x000001FC41742000-memory.dmp

Download

memory/1088-464-0x000001FC43780000-0x000001FC43A49000-memory.dmp

Download

memory/1088-465-0x00007FFC24960000-0x00007FFC24BA5000-memory.dmp

Download

memory/1088-456-0x00007FFC30170000-0x00007FFC3037B000-memory.dmp

Download

memory/1088-447-0x00007FFC304E0000-0x00007FFC305C3000-memory.dmp

Download

memory/1088-444-0x00007FFC30960000-0x00007FFC30A32000-memory.dmp

Download

memory/1088-439-0x00007FFC31140000-0x00007FFC31162000-memory.dmp

Download

memory/1088-440-0x00007FFC30E10000-0x00007FFC30E3B000-memory.dmp

Download

memory/1088-436-0x00007FFC30E40000-0x00007FFC310F6000-memory.dmp

Download

memory/1088-434-0x00007FF71A040000-0x00007FF71A138000-memory.dmp

Download

memory/2088-2242-0x00007FFC30A40000-0x00007FFC30A51000-memory.dmp

Download

memory/2088-2241-0x00007FFC30A60000-0x00007FFC30A74000-memory.dmp

Download

memory/2088-2233-0x00007FF71A040000-0x00007FF71A138000-memory.dmp

Download

memory/2088-2234-0x00007FFC311A0000-0x00007FFC311D4000-memory.dmp

Download

memory/2088-2235-0x00007FFC30E40000-0x00007FFC310F6000-memory.dmp

Download

memory/2088-2236-0x00007FFC3D400000-0x00007FFC3D411000-memory.dmp

Download

memory/2088-2237-0x00007FFC312B0000-0x00007FFC312C9000-memory.dmp

Download

memory/2088-2238-0x00007FFC31140000-0x00007FFC31162000-memory.dmp

Download

memory/2088-2239-0x00007FFC30E10000-0x00007FFC30E3B000-memory.dmp

Download

memory/2088-2240-0x00007FFC30A80000-0x00007FFC30E10000-memory.dmp

Download

memory/2088-2243-0x00007FFC30960000-0x00007FFC30A32000-memory.dmp

Download

memory/2088-2244-0x00007FFC306C0000-0x00007FFC30956000-memory.dmp

Download

memory/2088-2246-0x00007FFC304E0000-0x00007FFC305C3000-memory.dmp

Download

memory/2088-2247-0x00007FFC30490000-0x00007FFC304D1000-memory.dmp

Download

memory/2088-2248-0x00007FFC30460000-0x00007FFC3048F000-memory.dmp

Download

memory/2088-2249-0x00007FFC30440000-0x00007FFC30458000-memory.dmp

Download

memory/2088-2250-0x00007FFC30410000-0x00007FFC30436000-memory.dmp

Download

memory/2088-2251-0x00007FFC303E0000-0x00007FFC3040D000-memory.dmp

Download

memory/2088-2252-0x00007FFC303C0000-0x00007FFC303DA000-memory.dmp

Download

memory/2088-2253-0x00007FFC303A0000-0x00007FFC303B1000-memory.dmp

Download

memory/2088-2254-0x00007FFC30380000-0x00007FFC30391000-memory.dmp

Download

memory/2088-2255-0x00007FFC30170000-0x00007FFC3037B000-memory.dmp

Download

memory/2088-2256-0x00007FFC300D0000-0x00007FFC30168000-memory.dmp

Download

memory/2088-2257-0x00007FFC30080000-0x00007FFC300CF000-memory.dmp

Download

memory/2088-2245-0x00007FFC305D0000-0x00007FFC306B8000-memory.dmp

Download

memory/4624-728-0x00007FFC0B610000-0x00007FFC0B620000-memory.dmp

Download

memory/4624-727-0x00007FFC0B610000-0x00007FFC0B620000-memory.dmp

Download

memory/4624-726-0x00007FFC0D670000-0x00007FFC0D680000-memory.dmp

Download

memory/4624-725-0x00007FFC0D670000-0x00007FFC0D680000-memory.dmp

Download

memory/4624-723-0x00007FFC0D670000-0x00007FFC0D680000-memory.dmp

Download

memory/4624-724-0x00007FFC0D670000-0x00007FFC0D680000-memory.dmp

Download

memory/4624-722-0x00007FFC0D670000-0x00007FFC0D680000-memory.dmp

Download